You are deploying an Azure SQL Managed Instance into an existing virtual network named VNet1. When you attempt the deployment, it fails because the target subnet does not meet the platform requirements. You need to configure the subnet so that only Azure SQL Managed Instance resources can be deployed into it and Azure can automatically apply the required networking policies. What should you configure on the subnet?